[SpamCop-List] Re: What's the deal with geocities parsing - no go ?

[Mike Easter]

Asterix wrote:
www.spamcop.net/sc?id=z874912007zb7a4946ef6e77f4c07cdef5eb8c3e50ez

I'll address one of them.

That spam has two links which SC deobfuscates

http://au.geocities.com/massimiliano13368josephina33987/
http://au.geocities.com/ailsun42549evonne50420

SC does not resolve those links in your tracker.

If I feed the link/s naked to the parser, SC will resolve and provide a
notify addy

Parsing input: http://au.geocities.com/massimiliano13368josephina33987/
Routing details for 66.218.77.68 <snip>
Reporting addresses:
network-abuse at cc.yahoo-inc.com

If I create a new spam from the message to have it parsed:

http://www.spamcop.net/sc?id=z875205461z311a639484053b972cfed752e2715d18z

One time SC did not bother with resolving, the 2nd time SC resolved and
offered to notify

Re: http://au.geocities.com/ailsun42549evonne50420/ (Administrator of
network hosting website referenced in spam)
   To: network-abuse at cc.yahoo-inc.com (Notes)
Re: http://au.geocities.com/massimiliano13368joseph... (Administrator of
network hosting website referenced in spam)
   To: network-abuse at cc.yahoo-inc.com (Notes)

<cancelled>

IMO SC does not consider the process of resolving spamvertisers and
notifying spamvertisers to be of sufficient priority to bother with when
SC doesn't feel like it.  If we assign the parsing algorithm a 'mood' -
presumably based on resource management.

IMO the parser should have an additional option for reporters to be able
to use, that of devnulling the notifies to all found spamvertisers
without resolving them.

The advantage of that new mode is that in examples like your recent
experience, those spamvertisements would have been fed to the stats page
and to the sc-surbl listing service -- whereas with the current
configuration, nothing was done about the spamvertisers.


-- 
Mike Easter
kibitzer, not SC admin